IAM CreateRole with tags: can TagRole authorization be limited to creation without permitting ownership-tag adoption?

I am reviewing a least-privilege CloudFormation execution role that creates application IAM roles with required ownership tags. This is a pre-deployment review; no role-creation test has been performed for this investigation.

A read-only DescribeType response for AWS::IAM::Role in eu-central-1, captured on 2026-09-11, declares:

• tagging.tagOnCreate = true
• tagging.tagUpdatable = true
• tagging.cloudFormationSystemTags = false
• iam:CreateRole and iam:TagRole in handlers.create.permissions

These are schema declarations, not a capture of the IAM authorization context during creation.

The proposed design would allow CreateRole for narrowly scoped role ARNs with required aws:RequestTag values and an aws:TagKeys allowlist. For TagRole, it would additionally require existing ownership tags to match through aws:ResourceTag conditions.

The aim is to support initial tagged creation while preventing the same principal from assigning ownership tags to an existing untagged or differently tagged role within the permitted ARN scope.

Could someone clarify:

1. During authorization of CreateRole with inline Tags, what values are available to the TagRole permission check for aws:ResourceTag, aws:RequestTag, and aws:TagKeys? Are proposed ownership tags available as ResourceTag values during that check, or are these keys absent?

2. If requiring matching ResourceTag values prevents initial creation, is there a documented condition that permits the creation-time TagRole check while denying a standalone TagRole request against an existing unowned role with the same requested ownership tags? I am looking for a discriminator beyond the target ARN and requested tag values. If none exists, what supported control would enforce that separation?

3. Given cloudFormationSystemTags=false for this resource type, what documented guarantee, if any, does that provide about aws:cloudformation:* keys being absent from aws:TagKeys in this creation path? Please distinguish this declaration from other template or stack tag propagation.

Please distinguish a dependent authorization check from a separate API call: the absence of a separate TagRole CloudTrail event would not establish the condition-key context. If the answer depends on the active CloudFormation handler implementation, please identify the scope and evidence supporting that behavior.

References:

• IAM service authorization reference
• CreateRole API
• TagRole API
• Resource type schema

Documentation or an IAM service-specific explanation would be especially helpful.